Revision history [back]

Some fields, and particularly the answer_in field here requires a 2nd pass over the capture as the "answer" packet hasn't been dissected when the request is being dissected.

Try adding the -2 flag to tshark.